Crypto registration under the MLRs

What registration under the MLRs actually means

The MLRs place cryptoasset businesses within the UK's anti-money laundering and counter-terrorist financing framework. Under Regulation 56, a person must not act as a cryptoasset exchange provider or a custodian wallet provider unless they are included in the FCA's register of cryptoasset businesses. In plain terms, registration is a legal requirement to carry on business, not an optional badge.

The FCA is explicit that registration is not a recommendation or endorsement of a firm. It confirms that a business has satisfied the regulator on its money laundering and terrorist financing controls at the point of assessment. It does not signal that the firm's products are safe, that consumers are protected in the way they would be for authorised investment activity, or that the FCA has assessed the firm's wider conduct.

The regime exists to reduce the risk of cryptoasset services being used to launder money or finance terrorism, and the FCA's assessment focuses tightly on that objective, not on consumer protection.

Firms already authorised by the FCA for other activities, such as e-money or payment services, are not exempt. If they also carry on in-scope cryptoasset activity, they must register for that activity too.

Who needs a crypto FCA registration

Two categories of activity sit within scope under Regulation 14A of the MLRs. The first is the cryptoasset exchange provider, which covers exchanging cryptoassets for money or money for cryptoassets, exchanging one cryptoasset for another, and arranging those exchanges. This category also captures automated cryptoasset machines (crypto ATMs), peer-to-peer providers and issuers of new cryptoassets, such as initial coin offerings.

The second category is the custodian wallet provider. This covers firms that provide services to safeguard, or to safeguard and administer, cryptoassets on customers' behalf, or that safeguard the private cryptographic keys used to hold or move those cryptoassets.

To fall within the regime a firm must be carrying on the activity by way of business and in the course of business in the United Kingdom. The FCA assesses activity scope, the business-nature element and UK operational presence together.

A firm with no UK office or agents that simply allows UK customers to open accounts is not automatically treated as carrying on business in the UK. The assessment is fact-specific, so any firm with a UK nexus should consider its position carefully.

Why registration is not full FCA authorisation

A recurring source of confusion is the difference between MLR registration and authorisation under the Financial Services and Markets Act (FSMA). MLR registration is a targeted assessment of a firm's financial crime systems and controls. Full FSMA authorisation, by contrast, is a much broader assessment of a firm's business, its senior managers, its capital, its conduct and its ability to meet threshold conditions on an ongoing basis.

The UK is moving towards a dedicated FSMA regime for cryptoasset activity. The FCA has indicated that the FSMA authorisation gateway is expected to open on 30 September 2026, with the new regime expected to start on 25 October 2027. Firms carrying out regulated cryptoasset activities will need FSMA authorisation, and this will also apply to firms that are already registered under the MLRs.

Crucially, the FCA states that being registered under the MLRs does not guarantee authorisation under FSMA. The two processes are separate, even though firms will be able to apply for both once the new gateway opens. Existing registered firms should not assume their MLR status will carry them automatically into the FSMA regime.

In the meantime, MLR registration continues to operate, and firms that want to provide in-scope cryptoasset services in the UK before the new regime starts must still register before they begin trading. Preparing early for both regimes is sensible, and specialist support such as Nasara Authorise can help a firm understand how the two frameworks fit together.

The crypto FCA registration process step by step

The FCA runs the application through its Connect system. The process rewards firms that treat it as a serious systems-and-controls exercise rather than a form-filling task. Below is the broad shape of the journey, from preparation to decision.

A poorly prepared application is far more likely to be rejected on completeness grounds before the substantive assessment even begins. The FCA repeatedly stresses that omissions and draft documents are common reasons applications fail at the first hurdle.

The steps below summarise the FCA's published guidance on how to apply. Firms should always work from the current FCA pages and forms, as expectations are updated over time.

How likely are you to be approved

The headline statistic is sobering. In its update to 1 September 2024, the FCA reported that since January 2020 only 14% of applications had resulted in registration under the MLRs. In other words, the large majority of firms that applied did not secure registration.

The outcomes that do not result in registration break down into rejections, refusals and withdrawals. A rejection typically reflects an application that lacked the minimum required information. A refusal follows a substantive assessment and comes with a Warning Notice and a right to make representations. A withdrawal is where the applicant itself pulls out, often because the FCA has raised concerns it cannot resolve.

Commentators have observed that, across the earlier years of the regime, well over 85% of applications were rejected, refused or withdrawn. This reflects both the technical demands of the AML framework and the fact that many early applicants were not ready for the FCA's scrutiny of financial crime controls.

The chart below shows the FCA's published split since January 2020: the 14% that resulted in registration and the remaining 86% that did not.

The practical lesson is that quality of preparation matters enormously. Firms with strong, tested AML systems, a genuinely capable MLRO and complete, board-approved documentation are far better placed than those treating registration as a formality.

What the FCA expects to see in a strong application

The FCA has been clear that the difference between success and failure usually lies in the quality and completeness of the application. Applications that answer every question fully, use final rather than draft documents and reflect the firm's real operating model tend to progress; those with gaps or generic policies tend not to.

A capable MLRO is central. The FCA expects this individual to have appropriate knowledge of UK regulation, relevant cryptoasset experience, and the authority and independence to monitor and manage compliance. A nominal appointment without real substance is a common failing.

Firms should also expect ongoing obligations once registered. Registered cryptoasset businesses must submit an annual financial crime reporting return, known as REP-CRIM, through the FCA's RegData system within 60 business days of their accounting reference date, and they must pay an annual periodic fee to remain registered.

Because the assessment is demanding and the approval rate is low, many firms invest in specialist preparation before they apply, so that their systems, controls and documentation are ready for FCA scrutiny rather than being built during the assessment.

Conclusion

Crypto FCA registration under the MLRs is a mandatory financial crime gateway, not a full licence and not an endorsement. Any firm providing cryptoasset exchange or custodian wallet services by way of business in the UK must be on the FCA's register before it starts trading, and the regulator's focus is squarely on the quality of the firm's anti-money laundering systems and controls.

With only 14% of applicants registered since January 2020 and the majority rejected, refused or withdrawn, the message is consistent. Preparation is everything, and firms should also watch the incoming FSMA regime, since MLR registration will not automatically translate into future authorisation. This guide is educational information about the framework and does not constitute legal or compliance advice.

Frequently asked questions